Privacy Policy

1. Overview

This Privacy Policy describes how Dr. S. Hussain(“we,” “our,” or “us”), a clinical practice located in Siwan, Bihar, collects, uses, stores, and protects personal information when you use our website at https://doctorshussain.com/. This policy applies to information submitted through appointment request forms, cookies placed on your device, analytics stubs (if enabled), and any staff personally identifiable information (PII) processed for clinic operations.

By using this website, you acknowledge the practices described in this policy. If you do not agree with any part of this policy, please discontinue use of the website.

2. Information We Collect

We collect the following categories of information:

Appointment Request Form

• Full name of the patient (patientName)
• Mobile number (mobileNumber)
• Preferred appointment date (preferredDate)
• Preferred time window (preferredTimeWindow)
• Visit type: new or follow-up (patientKind)
• Preferred contact method: phone or email (preferredContactMethod)
• Consent confirmation (consentGiven)
• Server-side metadata: IP address, user agent string, and request timestamp logged for abuse prevention and audit

Device-Level Storage

• sessionStorage key appointment_draft_v1: A draft of your in-progress appointment request is stored locally on your device to prevent data loss if you navigate away or refresh the page. This data is never transmitted to our servers unless you explicitly submit the form.

Staff Sessions

• Session cookie: When clinic staff log in to the protected /staff area, a session cookie is issued for authentication.

3. How We Use Information

Personal information collected through this website is used only for the following purposes:

• To contact you via your stated preferred contact method (phone or email) solely for the purpose of confirming, rescheduling, or following up on your appointment request.
• For internal clinic operations, record-keeping, and clinical-medical documentation.
• To prevent fraud, abuse, and spam through rate-limiting, duplicate-detection, and server-side audit logs.

We never share your personal information with third parties outside the direct operations of the clinic, except as required by law or with service providers who are contractually bound to protect your data and process it only on our instructions. There is no marketing use of your data under any circumstances.

Legal basis: By submitting the appointment request form and providing explicit consent, you authorise the processing of your personal data for the contract-performance purpose of confirming your appointment.

4. Cookies & Local Storage

Session Cookies (Staff Only)

• csrf token: A CSRF protection cookie set for state-changing requests.
• staff_session: An authentication session cookie issued only after a successful staff login.

All session cookies are marked as httpOnly (not readable by JavaScript), Secure, and SameSite=Lax for security.

Session Storage (Appointment Draft)

The appointment_draft_v1 entry is saved in sessionStorage on your device only. It is cleared automatically when your browser tab closes, or when you successfully submit the form. It is never sent to our servers unless you click the submit button.

Analytics

No tracking cookies are set by default. Any NEXT_PUBLIC_* analytics integration is strictly opt-in and will only be activated after the clinic has configured and approved it.

5. Third-Party Disclosures

• No ad networks. We do not sell, rent, or share your data with advertising networks.
• No data brokers. We do not disclose any personal information to data brokers or list brokers.
• Google Maps embed: If you click a directions link, you will be redirected to an external Google Maps page. Google’s privacy practices apply once you leave our website.
• Legal requirements: We may disclose information when required by a valid court order, warrant, or applicable law.

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of any inaccurate or incomplete personal data.
• Erasure (Right to Be Forgotten): Request deletion of your personal data, subject to any legal or regulatory retention obligations.
• Withdraw Consent: Withdraw any consent previously given for data processing. This does not affect the lawfulness of processing carried out before withdrawal.
• Data Portability: Request your personal data in a structured, machine-readable format.
• Lodge a Complaint: Raise a concern with the appropriate supervisory authority if you believe our processing violates applicable law.

To exercise any of these rights, please contact us: by phone at 095238 33347, in writing at Gaushala Rd, Pakari More, Siwan, Bihar 841227.

7. Data Retention

Appointment request data and associated clinical-medical records are retained for a minimum of 7 years from the date of the appointment, in line with Indian clinical record-keeping standards and practice guidelines. After the applicable retention period, the data is securely deleted or anonymised, unless a legal hold or ongoing regulatory requirement requires extended retention.

8. Security

We apply the following technical and organisational measures to protect personal data:

• TLS/HTTPS: All traffic to and from the website is encrypted. Enabling HTTPS on the production domain is a documented launch blocker (domain-https).
• CSRF protection: Cross-site request forgery tokens are used for all state-changing requests.
• Rate limiting: Form submissions and API endpoints are rate-limited to prevent abuse and credential-stuffing attacks.
• PII redaction: Structured server logs apply automatic redaction rules so that sensitive PII is not persisted in plain-text logs.
• Password hashing: Staff passwords are stored using PBKDF2 with appropriate work factors and unique per-account salts.
• HttpOnly session cookies: Staff session cookies are not readable by client-side JavaScript, reducing exposure to XSS attacks.

No method of transmission or storage is 100% secure, but the measures above are designed to provide a level of security appropriate for the sensitivity of the data processed.

9. Children’s Privacy

The clinical services described on this website are intended for adults. For any minor patient (under the age of 18), appointment requests and personal data must be submitted by a parent or legal guardian who consents on the minor’s behalf. A guardian must be present at the time of any in-person consultation for a minor.

10. Changes to This Policy

This Privacy Policy may be updated at our discretion to reflect changes in practice, legal requirements, or website functionality. When changes are made, the “Date of last review” line at the top of this page will be updated. We encourage you to review this page periodically.

11. Contact for Privacy Concerns

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact: